Executive Summary
A sophisticated zero-day exploit chain targeting Ivanti Connect Secure VPN appliances has been observed in the wild, enabling unauthenticated attackers to achieve root-level remote code execution (RCE) on fully patched devices. This attack, leveraging multiple previously unknown vulnerabilities, bypasses authentication controls and escalates privileges, granting adversaries full control over affected appliances. The exploitation campaign, attributed to a highly skilled threat actor, has resulted in credential theft, Active Directory reconnaissance, and advanced anti-forensic measures. Organizations relying on Ivanti Connect Secure for remote access are at critical risk and must take immediate action to mitigate exposure.
Threat Actor Profile
The campaign has been attributed to a threat actor tracked as UTA0576 by Volexity. This actor demonstrates advanced operational security, technical proficiency, and a focus on stealth. The group’s tactics, techniques, and procedures (TTPs) indicate a criminally motivated adversary rather than a state-sponsored espionage group. UTA0576 is characterized by its use of ephemeral, in-memory payloads, rapid credential harvesting, and meticulous log manipulation to evade detection. The actor’s infrastructure includes leased virtual private servers and anonymized VPN endpoints, complicating attribution and takedown efforts.
Technical Analysis of Malware/TTPs
The attack chain exploited three distinct vulnerabilities in Ivanti Connect Secure (ICS) appliances, including versions up to 22.8R2.4 (Build 19097) and older releases such as 25.1.1 and 25.1.2. The initial vector was an authentication bypass in the welcome.cgi endpoint, which allowed unauthenticated HTTP requests to be routed to privileged CGI scripts using a crafted X-DSCGI-PATH header. This flaw enabled attackers to access internal handlers such as wu.cgi, which is responsible for file uploads.
The second stage involved uploading a malicious Perl script disguised as a .zip file. The wu.cgi handler would write the file to /home/runtime/tmp/<MD5(filename)> before validation and deletion. Attackers exploited a race condition, invoking the script via the same header trick before it was deleted, achieving remote code execution as the cgi-server user.
Privilege escalation was accomplished by in-memory patching of the /home/lib/libdsplibs.so library. The attacker modified the DSCache configuration to redirect a maintenance task, causing the system to execute a Perl interpreter as root. After execution, the exploit restored the original memory state, effectively erasing forensic evidence and bypassing integrity checks.
Post-exploitation, the attacker deployed custom Python and Kerberos tools for Active Directory reconnaissance, extracted domain credentials, LAPS passwords, BitLocker keys, and performed Kerberoasting. Network reconnaissance included DNS and host enumeration, as well as password spraying. For credential capture, a renamed tcpdump binary (/data/.icscap/dsstatmond) was used to intercept LDAP and HTTP traffic. Anti-forensic measures included deletion and tampering of logs (/home/runtime/dlogs/debuglog, /var/log/audit/audit.log), self-deletion of payloads, and restoration of original configurations.
Exploitation in the Wild
The zero-day chain was actively exploited in the wild prior to public disclosure. Victims included organizations across multiple sectors, with a focus on those with exposed Ivanti Connect Secure VPN endpoints. The attacker did not deploy persistent webshells or backdoors; instead, all malicious activity was conducted via chained exploits and ephemeral scripts, minimizing the forensic footprint. The campaign was characterized by rapid credential harvesting, lateral movement preparation, and immediate anti-forensic actions. Outbound connections to attacker-controlled infrastructure, such as the Evoxt VPS at 108.165.147[.]64, were observed for exfiltration of compressed and encoded credential data.
Victimology and Targeting
Victims of this campaign were primarily organizations with internet-facing Ivanti Connect Secure appliances. The targeting appeared opportunistic, with the attacker scanning for vulnerable endpoints and exploiting them en masse. Sectors impacted included government, finance, healthcare, and technology. The attacker’s focus on credential theft and Active Directory reconnaissance suggests an intent to facilitate further lateral movement within victim environments, potentially enabling ransomware deployment or data exfiltration in subsequent stages.
Mitigation and Countermeasures
Immediate patching is imperative. Organizations must apply the latest security updates released by Ivanti addressing CVE-2026-104935 and monitor for subsequent advisories related to privilege escalation. Security teams should review logs for unusual requests to /dana-na/auth/url_default/welcome.cgi containing suspicious X-DSCGI-PATH headers, and inspect for the presence of unauthorized files or scripts in /tmp/ and /data/.icscap/. Given the attacker’s anti-forensic techniques, reliance on the Ivanti Integrity Checker Tool alone is insufficient; comprehensive memory and disk forensics are recommended.
Network monitoring should be configured to detect outbound connections to known attacker infrastructure, such as 108.165.147[.]64, and to identify exfiltration of compressed or encoded files. Organizations should also review Active Directory logs for anomalous LDAP queries and Kerberos ticket requests. Enhanced monitoring of VPN appliance integrity, coupled with regular vulnerability scanning and segmentation of remote access infrastructure, will reduce exposure to similar attacks.
References
Volexity: Chained Exploitation of Ivanti Connect Secure Zero-Days (Full Technical Analysis), Aviatrix Threat Research Center: Ivanti Connect Secure Zero-Days CVE-2026-104935, CISA Advisory: Threat Actors Exploit Multiple Vulnerabilities in Ivanti Connect Secure, Ivanti Security Advisory, Volexity GitHub: IOCs and Detection Rules
About Rescana
Rescana empowers organizations to proactively manage third-party risk and supply chain security through our advanced TPRM platform. Our solution delivers continuous monitoring, automated risk assessments, and actionable intelligence to help you stay ahead of emerging threats. For more information or to discuss how Rescana can enhance your organization’s cyber resilience, we are happy to answer questions at info@rescana.com.
